• TRACE
  • VERIFY
  • AUDIT
  • REVIEW

How to audit permission hierarchies with your AI

Connect OpenFGA to your agent to map out access rights. Once connected, your AI can walk through your permission logic to find holes or confirm access.

Ask AI about this page

Short answer

How can I audit my permission hierarchies with an AI?

Your agent uses OpenFGA to trace the relationship paths between users and resources. It can check specific access rights or list all users within a scope to find unexpected permissions. You'll get a clear map of why access was granted or denied.

The audit outcomes.

Where your findings land.

The AI handles the heavy lifting of traversing the graph so you can focus on the results.

TRACE

Permission path maps

The AI follows the logic of your relations to show exactly how a user reached a resource. You get a step-by-step breakdown of the hierarchy.

VERIFY

Access confirmation

Your agent checks if a specific user meets the requirements for a role. It confirms if the current logic matches your security intent.

AUDIT

User scope reports

The AI pulls lists of users tied to specific relations. This helps you spot over-privileged accounts or orphaned permissions.

REVIEW

Human oversight

The AI flags suspicious or overly broad paths. You decide if the permission logic needs to be rewritten or tightened.

The workflow

What your AI does when the audit starts.

The agent interacts with your OpenFGA instance to pull the data needed for the analysis.

  1. Identify users

    The agent identifies which users are relevant to the specific permission group or resource you are auditing.

    list_users

  2. Check specific access

    The agent tests a specific user against a resource to see if the relationship exists in your model.

    check_relation

  3. Expand the hierarchy

    To understand the full scope of a permission, the agent expands the relation to see all downstream effects.

    expand_relation

  4. Summarize findings

    The agent compares the actual permission paths against your expected security rules and highlights discrepancies.

    check_relation

Try it

Copy these to start.

Use these prompts to kick off an audit with your agent.

Starting points

Swap out the resource names and user IDs with your actual OpenFGA data.

OpenFGA Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_VDWoQMoj6eTPYg6n6XBuedyNPsCIKIje0Bwlugcp/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — OpenFGA capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "openfga-fine-grained-auth-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_VDWoQMoj6eTPYg6n6XBuedyNPsCIKIje0Bwlugcp/mcp"
    }
  }
}
Copy into chat04

  • Check if user:dev_admin has the 'owner' relation to resource:production_db.

  • List all users who have 'editor' access to the 'marketing_folder' resource.

  • Expand the 'viewer' relation for resource:api_keys to see everyone who can read them.

  • Audit the permission path for user:guest_user to see why they can access resource:public_assets.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect OpenFGA once, then ask.

One connection gives your agent access to your permission data. Your credentials stay encrypted and secure on our side.

Connect OpenFGA to your AI

FAQ

How the audit behaves

  • 01

    Can the AI change my permission rules?

    No. The AI can only read and check existing relations. It cannot write or modify your OpenFGA model.

  • 02

    Can the AI delete users from my system?

    No. The tools only allow for listing, checking, and expanding relations. User management remains a manual task for you.

  • 03

    How does the AI know why a user has access?

    It uses the expansion tool to trace the specific chain of relations that connects a user to a resource.

  • 04

    Does this work with any permission model?

    It works with any model implemented via OpenFGA.

  • 05

    Can I use this to find all admins in my system?

    Yes, by listing the users associated with the admin relation in your model.

  • More questions about OpenFGA? The Connector page answers them. See everything the OpenFGA Connector can do

Connect OpenFGA to Claude, Cursor, ChatGPT & more